What is the appropriate response to an online attack?

For the past 18 months, Dr Peter Cave has led a concerted campaign against Chessington World of Adventures. He has launched several websites and sent no fewer than 80,000 emails to Surrey residents and employees of the theme park’s operator Merlin, all criticising its safety record.

But Cave is not a random dissatisfied customer. His campaign is based on the findings of a safety report that his consultancy Peer Egerton produced on behalf of Merlin, which commissioned the analysis in 2012 following a serious incident at Chessington World of Adventures, which has more than 1.6 million visitors a year.

The report highlighted 2,000 safety issues and recommended remedial work be undertaken by Merlin at a total cost of £4.6 million.

But somehow between the commissioning and publication of the report, the relationship between Merlin and Peer Egerton, which has since been wound up, broke down. And Cave began to use his consultancy’s findings as the basis of what Merlin describes as a ‘campaign of harassment’.

Merlin believes that the ‘baseless’ criticisms, which are ‘highly alarming, distressing and disgraceful’, are motivated not by concerns over safety but by financial demands from Cave, who was recently made bankrupt, that have already been dismissed in court.

But the theme park operator’s attempts to stop Cave’s campaign have so far failed. In September, the High Court refused to grant the company an injunction to stop the campaigner sending mass emails. The emails, it pointed out, included a link to unsubscribe from future ones. And the judge concluded that the issues raised by Cave about Chessington’s management and the regulation of theme parks were ‘matters of public interest’, and that he was doing no more than exercising his right to freedom of expression.

Freedom of speech

But the ruling is a worrying development for corporates. The decision highlights the conflict of interest between the right of an individual to freedom of speech, and the right of an individual or corporate to be free of harassment. Hostile attacks are on the rise, fuelled by the Internet and social media that can transform a one-off individual grievance into a concerted campaign at the touch of a button.

‘Companies have faced attacks from those who disagree with them for decades,’ says Lucy Hartley, social media consultant at Investis. ‘The difference now that we are in the social age of the Internet is that everyone has a platform and a voice.’

Disgruntled ex-employees, suppliers, business rivals, environmental and shareholder activists and other hostile parties can criticise a company and quickly galvanise support on a huge scale. And, as Mark Flanagan, partner at Portland Communications, points out, where business leaders might once have been given some benefit of the doubt, the financial crash, and ‘a culture of diminishing deference towards authority’, has made them ‘fair game for direct and even hostile treatment’.

The unharnessed nature of the attacks makes responding effectively particularly tricky. And the once well-trodden route of a legal defence is increasingly risky, particularly as coverage of court battles often only serves to provide the harassment with more publicity.

For corporates, this leaves a burning question: just how are they meant to respond to an increasing number of sizeable and often sustained hostile attacks?

The law still stands

For Alexandra McCready, associate at law firm Schillings, legal redress may still be an answer but only in certain situations. ‘The door is still open for interim injunctions to be granted in harassment cases – but now we have more guidance as to what evidence will be needed to seek such remedy,’ she says. When a company is unwilling to take an issue to court, legal frameworks may still be used to get the content pulled at source.

But even McCready is reticent. ‘When we’re advising a client, we have to consider the reputational risk of a backlash of taking legal action,’ she says. ‘We don’t always advocate legal remedy. It depends on the situation and what the cause of the campaign is.’

‘In my experience, businesses too often have a knee jerk response to online criticism and immediately want something taken down or to go legal,’ says Flanagan. ‘If you are perceived to be too heavy handed and secretive then it is usually counterproductive and only serves to inflame your opponents.’

Andrew Griffin, chief executive at Regester Larkin, agrees, adding that communicators should instead ‘make sure they have a clear message supported by irrefutable evidence (proof points) which they can confidently and proactively tell to their stakeholders’.

Responding to the unknown

Such messaging becomes more difficult, however, if the source and motive of the campaign are not clear. Last month, shares in G4S were hit after online activists emailed a fraudulent statement to journalists suggesting that the FTSE 100 company had discovered errors in its accounts and that they would be restated.

The press release, which linked to a fake website, stated that the company’s finance chief, Himanshu Raja, had been sacked while its group general legal counsel had resigned. So convincing was the attack that some journalists thought it was real and started reporting the news on Twitter. At the same time the company’s share price became noticeably more volatile.

The website – which was later suspended – set out to replicate G4S.com. The telephone number on the release was answered by an automated message that told callers the press office was currently unable to take their calls.

Hartley explains: ‘The G4S example was interesting because it was considered and well executed. It was also notable that while it came from an activist group angry at G4S’s work in border control, among other things, the release and website didn’t call G4S out on any of these issues. The aim of the attack was to hit the share price, so much so that it was initially thought the release had come from someone trying to short the stock.’ The growing sophistication of attacks such as this is exactly why Schillings takes time with clients to investigate who’s behind a campaign and their motivation before deciding how to respond. ‘We look at patterns of behaviour and activity to verify a hostile campaign is taking place, what kind of tactics they’re using and what kind of campaigns they’ve run before,’ says McCready. ‘Motives aren’t always what they appear to be. And understanding motive can help develop a really effective defence.’

For Schillings, this likely will not mean racing to court so much as communicating effectively with the press to cast doubt on the credibility of an attack and prevent its spread. ‘Journalists have an obligation to behave responsibly and, under the new Defamation Act, the courts will look at what steps they have taken when preparing stories to verify sources and motives,’ adds McCready. ‘If organisations can credibly cast doubts on the motives of the campaigner, it can sway journalists from relying too much on the allegation, which can be really useful.’

The power of positivity

There are other non-legal remedies too. Companies are emerging to specifically help address negative content online. Igniyte is just such a business, helping its clients to clear criticism off Google by pushing up positive content instead.

‘We deal with a lot of issues around reviews often posted by competitors and disgruntled ex-employees,’ says Simon Wadsworth, managing director of Igniyte. ‘Quite a few cases involve companies and key senior figures being trolled online in a concerted campaign that can include specifically set up blogs defaming the company and its executives. This can be very damaging.’

Wadsworth says that one of the first things Igniyte does is to get the client not to react. ‘The better approach is to analyse the content, see what terms and conditions and legal frameworks we can use to calmly approach the publishers or Google with a well thought and evidenced case where appropriate. Often in these cases we can get the content pulled at source,’ he says. ‘Where we can’t take this route we then work with the brand or company to improve the positive content online to counter balance any negative flaming.’ The perpetrator may not immediately notice the change, but over time will find they need ever more resources (and willpower) to maintain their campaign.

Such a strategy supports the measured response advocated by Schillings but also flies in the face of the typical crisis management advice, which is to get a response out quickly.

McCready admits that this can lead to tension between communications and lawyers over the timing of a response, although most would agree that a misinformed or a misjudged response can be worse than none.

But Igniyte’s solution is not quick. ‘Where we can pull content then we can deliver quick wins but in most cases it’s a long process,’ says Wadsworth. ‘We are at pains at the start of most projects to make the client realise there is no quick fix.’

Wadsworth cites a global luxury brand that came to Igniyte over a significant online backlash to a Facebook advert that was deemed to be in bad taste.

‘They had ten negative pages on Google and it took us 18 months to make a significant impact on that,’ he says.

Be prepared

The enormous challenges of responding effectively to hostile attacks must mean that the best remedy of all is, of course, to avoid attacks in the first place. ‘The biggest trend we’ve seen is clients wanting to invest more time in formally managing reputation risk,’ says McCready.

‘So we will draw in experts from across the business to identify and analyse threats to reputation, the actions that might drive hostile campaigns and the possible outcomes.’ By pre-identifying risk, McCready argues that companies have a better chance of nipping hostile campaigns in the bud. And by training communications teams in the legal rules and landscape, they will know in advance exactly what needs to be escalated to the legal team, and at what point.

Viv Jemmett, deputy head of digital at Hanover, believes good social media monitoring is also key. ‘There are a number of monitoring services available that serve all kinds of requirements, but most important is having an alerts function which ensures you are aware of complaints or negative comments,’ he says. ‘It’s important to remember that you can’t stop someone complaining on social media, but you can help to resolve the issue [before it becomes a full-blown campaign].’

Companies will have an advantage too if they invest time in developing a strong and socially-aware brand identity online.

‘Consumers are increasingly concerned with the values and behaviours of the companies behind big brands,’ says Portland’s Flanagan. ‘The most successful brands stand for an ideal beyond their products and services. Clearly articulating that ideal to multiple audiences is the key to building a durable reputation.’

Flanagan points to Sir Richard Branson whom, he believes, will have ‘goodwill credit in the bank’ that will allow him to overcome the recent problems in his Virgin Galactica venture. ‘It does insulate you against a crisis if people believe you have good motives,’ he says.

There is much that companies can do to protect their businesses against hostile attacks, from nurturing positive sentiment to analysing risk and managing possible threats upfront. For example, McDonald’s has launched a mythbusting Our Food. Your Questions campaign across the world to explain exactly what goes into its products.

The world’s largest restaurant chain has released behind-the-scenes videos and infographics to illustrate the processes behind products like Chicken McNuggets and the McRib. It is also answering real customers’ questions online in real time but in this social media age, it is a rare company that will avoid all negativity including some potentially harmful and concerted campaigns.

Responding to such attacks will never be easy. Debate may be needed just to agree how quickly a company should respond to such an attack – especially if the source and motive is unclear. Even threatening legal action – the old and trusty weapon of the larger corporate – now comes weighted with risks all of its own, and heightened by the findings of the Chessington case.

But even in the worst case scenarios, where a company is taken completely by surprise, there are solutions. It may take time and considerable resources, but for every hostile attack, so increases the numbers of those who have the experience and the tools to deal with them.